Atlassian security advisory (AV26-1002) - Update 2

Serial number: AV26-1002
Date: October 5, 2026
Updated: October 15, 2026

As of October 5, 2026, Atlassian is affected by a vulnerability in the following products:

  • Bamboo Data Center
    • Version 10.2.4 and prior
    • Version 12.1.12 and prior
  • Bamboo Server
    • All versions
  • Bitbucket Data Center
    • Version 10.2.8 and prior
    • Version 10.5.1 and prior
    • Version 9.4.26 and prior
  • Bitbucket Server
    • All versions
  • Confluence Data Center
    • Version 10.2.19 and prior
    • Version 9.2.26 and prior
  • Confluence Server
    • All versions
  • Crowd Data Center
    • Version 6.3.7 and prior
    • Version 7.0.3 and prior
    • Version 7.1.1 and prior
    • Version 7.2.4 and prior
  • Crowd Server
    • All versions
  • Crucible Data Center
    • Version 4.9.15 and prior
  • Crucible Server
    • Version 4.9.15 and prior
  • Fisheye Data Center
    • Version 4.9.15 and prior
  • Fisheye Server
    • Version 4.9.15 and prior
  • Jira Service Management Data Center
    • Version 10.3.26 and prior
    • Version 11.3.12 and prior
    • Version 5.12.40 and prior
  • Jira Service Management Server
    • Version 5.12.40 and prior
  • Jira Software Data Center
    • Version 10.3.26 and prior
    • Version 11.3.12 and prior
    • Version 9.12.40 and prior
  • Jira Software Server
    • Version 9.12.40 and prior

Update 1
Open source reporting indicates that CVE-2026-21589 is being exploited in the wild.

Update 2
On October 15, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21589 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Date modified: